Eleven Controls, One Explosion: Why Procedures Alone Are Not Enough
Prefer to listen? Here is the audio companion for this article.
Eleven administrative controls. A known hazard. Approximately $95 million in damage.
That should make any leader stop and ask: Are we controlling the risk, or are we counting the controls?
On June 4, 2025, an explosion and fire damaged a furnace at Shell’s Monaca, Pennsylvania, facility. Fifteen employees evacuated. According to the U.S. Chemical Safety and Hazard Investigation Board (CSB), no one was killed or seriously injured.
The CSB’s September 2026 findings highlight a problem that reaches well beyond chemical manufacturing: a long list of procedures can create confidence without providing enough protection.
What happened?
As the furnace was being returned to service after cleaning, a process control engineer inadvertently opened two isolation valves. That allowed flammable gas to flow backward into the furnace, where it contacted lit pilots and ignited.
The CSB found that the engineer had never performed the task before and had limited process knowledge. The control screen displayed three nearly identical valves with identification tags that differed primarily by their final digit.
But this was not simply a matter of someone selecting the wrong valve.
Shell had identified backflow as a potentially fatal hazard. It relied on 11 administrative controls that depended on workers and managers following procedures. Available engineered safeguards had not been configured to prevent backflow during the removal of double isolation.
The hazard was recognized. The protection still depended too heavily on people getting the steps right.
Look beyond the last person who touched the equipment
What stands out to me is how easily this could become a conversation about employee error instead of the conditions that allowed that error to become an explosion.
Yes, the wrong valves were opened. That matters. But so does assigning an unfamiliar critical task, providing controls that are difficult to distinguish, and leaving a dangerous flow path without adequate engineered protection.
Accountability should include the decisions that shaped the work, not just the person performing it.
Procedures and training are necessary. They help people understand what to do. But when a mistake can have catastrophic consequences, we need to ask what prevents that mistake from reaching its worst possible outcome.
What leaders should take from this
Look at your highest-consequence work.
Where does preventing a serious injury or major release depend entirely on someone remembering a step, following a sequence, or catching another person’s mistake? Those situations deserve a closer review of whether the protection is strong enough.
Check what changes when normal operations stop.
Maintenance, cleaning, startup, and shutdown change conditions. Do not assume a safeguard that protects routine production also protects every transition. The CSB recommended engineered protection against backflow during all modes of furnace operation.
Set people up to perform critical work correctly.
Verify readiness for the specific task. Provide experienced support when the work is unfamiliar. Make labels and controls easy to distinguish. Telling someone to “be more careful” does not fix a confusing interface or a gap in protection.
One question worth asking
At your next operational review, ask:
“If someone makes a foreseeable mistake during this task, what keeps it from becoming a serious incident?”
If the answer comes back to training, procedures, and paying attention, keep asking questions.
No one was killed or seriously injured at Monaca. That is an opportunity to learn, not evidence that the controls were good enough.
For me, the takeaway is straightforward: Do not measure the strength of your safety program by how many controls you can list. Measure it by how well those controls protect people when the work does not go as planned.
Source: CSB investigation findings and recommendations, September 16, 2026
